CVE-2026-33477CWE-863

FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content

Medium · published March 26, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/api/file/snippet.php` allows an authenticated user with only `read_own` access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the `read_own` enforcement for hover previews. Version 3.11.0 fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-26T17:09Z
EPSS history
Timeline
  • 26 MAR 17:09Z
    FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
    cvelistv5